Fast incremental backup method and system

ABSTRACT

A method of incremental backup of a storage device includes reading descriptors of logical storage units of the storage device; comparing the descriptors of the logical storage units of the storage device with descriptors of archived logical storage units; for logical storage units of the storage device whose descriptors are not identical to the descriptors of the archived logical storage units, backing up contents of physical storage units that correspond to those logical storage units of the storage device; and, for logical storage units of the storage device whose descriptors are identical, performing a comparison step to check if these logical storage units need to be backed up. The logical storage units can be files. The comparison step can be, e.g., (1) bit-wise comparison of the logical blocks, (2) comparing control sums of the logical blocks, and (3) comparing log files relating to the logical storage units The physical storage units can be blocks. The descriptors can be, e.g., MFT entries, hash function values, timestamps, checksums, and file metadata. The descriptors can be compared on a physical storage unit basis. The method further can optionally include generating a bitmap of the physical storage units of the storage device; marking, in the bitmap, those physical storage units that correspond to logical storage units with different descriptors; and archiving content of the physical storage units marked in the bitmap. The method can further optionally include archiving logical storage units of the storage device having the same name as corresponding archived logical storage units of the storage device, but different time stamps.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to archiving and copying of data, and moreparticularly, to archiving of hard disk drive (HDD) data at variouspredetermined points in time.

2. Description of the Related Art

Currently, there are a number of conventional methods that relate toorganization of data archiving. One of these is a backup of the entirehard drive, which typically involves copying of the hard drive contentonto some other medium, such as another hard disk drive, a DVD ROM, aDVD RAM, a flash disk, etc. The primary disadvantage of such a method isthe need to backup what is frequently a very large amount of data,which, on the one hand, results in a relatively lengthy process ofarchiving, and, on the other hand, frequently requires relatively largeavailable space for the archived data. This ultimately results in arelatively high cost of archiving per unit of archived data.

Another approach is often referred to as “incremental backup,” whichgenerally decreases the amount of space required for the archiving. Withthe incremental backup, typically the contents of the hard disk drive isarchived, or stored somewhere once. After that, only that data that hasbeen changed, or added, since the previous backup, or since the perviousincremental backup, is actually archived. Recovery of data from thearchive typically involves merging of the original backup and thevarious incremental backups.

There are generally two conventional approaches to implementing theincremental backup. One approach is to archive data in the form oflogical structures, such as files. The second approach is to preservethe physical structures as they are represented on a storage medium. Inother words, in the second case, sectors, clusters, and other physicaldata blocks are archived.

Despite the fact that incremental backup on a logical level makes iteasier to identify data that is subject to archiving, in a number ofsituations, this approach is unacceptable. For example, backup on aphysical level provides an ability to restore the functionality of thecomputing system, since it is possible to restore hidden and otherwiseunmovable data blocks, for example, hidden and system areas of the disk,including boot areas.

At the same time, incremental backup on a physical level requiresidentifying the blocks that are subject to archiving, in other words,identifying blocks whose content did not change since the priorarchiving operation. When data block level comparison level is used,this task requires a considerable time and CPU resources, both for datablock comparison and for extraction of previously archived data blocksfrom the archive.

Accordingly, there is a need in the art for an effective and efficientmethod of identifying data blocks that are not subject to archiving,which minimal time and effort.

SUMMARY OF THE INVENTION

Accordingly, the present invention is related to a fast incrementalbackup method and system that substantially obviates one or more of thedisadvantages of the related art.

In one aspect, there is provided a method of incremental backup of astorage device, including (a) selecting an area of the storage devicefor backup; (b) reading descriptors of logical storage units of theselected area; (c) comparing the descriptors of the logical storageunits of the selected area with descriptors of already archived logicalstorage units; (d) for physical storage units of logical storage unitsof the selected area whose descriptors are not identical to thedescriptors of the archived logical storage units, checking if thesephysical storage units need to be backed up; and (e) backing up contentsof physical storage units identified in step (d).

The logical storage units can be files. The comparison step can be,e.g., (1) bit-wise comparison of the logical blocks, (2) comparingcontrol sums of the logical blocks, and (3) comparing log files relatingto the logical storage units. The physical storage units can be blocks.The descriptors can be, e.g., MFT entries, hash function values,timestamps, checksums, and file metadata. The descriptors can becompared on a physical storage unit basis. The method can optionallyinclude generating a bitmap of the physical storage units of the storagedevice; marking, in the bitmap, those physical storage units thatcorrespond to logical storage units with different descriptors; andarchiving content of the physical storage units marked in the bitmap.The method can optionally include archiving logical storage units of thestorage device having the same name as corresponding archived logicalstorage units of the storage device, but different time stamps.

Additional features and advantages of the invention will be set forth inthe description that follows, and in part will be apparent from thedescription, or may be learned by practice of the invention. Theadvantages of the invention will be realized and attained by thestructure particularly pointed out in the written description and claimshereof as well as the appended drawings.

It is to be understood that both the foregoing general description andthe following detailed description are exemplary and explanatory and areintended to provide further explanation of the invention as claimed.

BRIEF DESCRIPTION OF THE ATTACHED FIGURES

The accompanying drawings, which are included to provide a furtherunderstanding of the invention and are incorporated in and constitute apart of this specification, illustrate embodiments of the invention andtogether with the description serve to explain the principles of theinvention.

In the drawings:

FIG. 1 illustrates one general exemplary method of the presentinvention.

FIG. 2 illustrates identification of physical storage units that shouldnot be subject of incremental backup.

FIG. 3 is a schematic diagram of an exemplary computer or server thatcan be used in the invention.

FIG. 4 is a schematic diagram of storage structures treatment accordingto one embodiment of the invention.

DETAILED DESCRIPTION OF EMBODIMENTS OF THE INVENTION

Reference will now be made in detail to the embodiments of the presentinvention, examples of which are illustrated in the accompanyingdrawings.

In order to make the archiving process more efficient, it is proposed toform a backup on a physical level, and in addition, to use informationthat characterizes the logical structure of the data storage device,such as a hard disk drive.

It should be noted that this approach, in some cases, does not alwaysidentify every single data block that is not subject to archiving.However, the proposed method, with a minimal expenditure of time andresources, provides for a guaranteed exclusion of a substantial majorityof the blocks from archiving of those blocks that do not need to bearchived. Subsequently, for those blocks were not excluded fromarchiving, and are therefore subject to archiving, it is possible to usetraditional methods and other suggested mechanisms to further reduce thenumber of data blocks that are actually subject to archiving.

In order to implement the proposed methods, the following steps areutilized:

First, on a physical level, a complete (or partial) snapshot of thestorage medium is formed, and a time stamp of the snapshot is recorded(although it is also possible to work without a time stamp, by usingother descriptors, such as hash functions, discussed below, filemetadata, file names, MFT contents, etc.). When a second archivingoperation is performed, a bitmap of the data blocks of the hard diskdrive is formed. For example, this can be a bitmap of data blocks thatare subject to archiving, or a bitmap of used data blocks of the harddisk drive (i.e., blocks of the hard disk drive that contain usefuldata, rather than “empty” blocks, or free blocks).

During subsequent archiving of the hard disk drive, a comparison of thedescription of the logical structures of the drives is performed. Thiscomparison characterizes the distribution of the data of the logicalstructures into data blocks. If the logical structures (including theaddresses of the blocks) correspond to each other, the data blocks thatare occupied by the corresponding logical structures are identified, andfor these blocks, the corresponding bit in the bitmap is cleared.

At the same time, it is also possible to retain, in the incrementalsnapshots, those blocks that were previously archived. However, asubstantial increase in the speed of identifying the blocks that do notneed to be archived compensates for this. If it is necessary to reducethe downtime of the computing system or server, the advantages of theabove approach are fairly substantial. In other words, comparing thetime needed for a full backup with the time necessary for a bit-wisecomparison of the data block's content (given the necessity ofunarchiving of the contents of one or more copies of the data, and thetime necessary to implement a single backup in the proposed approach),the advantages of the proposed approach are self-evident.

Note that logs or change journal entries can be used to at leastpartially exclude various logical structures from the analysis. In otherwords, the fact that journal entries exist in the logs means that somechanges have been made to the data in the blocks or files, and,therefore, they do need to be backed up without further checks. In sucha way those physical storage units may be excluded from the selectedarea, or may be included in the selected area if only some blocks ofthose files may be modified

A file system such as NTFS creates an MFT and associated log file thatrecords file transaction information and implements file systemrecoverability. Because the log file is a system file, it can be foundearly in the boot process and used to recover the disk volume, ifnecessary. When a user updates a file, the Log File Service records allmetadata redo and undo information for the transaction. Forrecoverability, “redo” information in the log file allows NTFS to rollthe transaction forward (repeat the transaction if necessary), and“undo” allows NTFS to roll the transaction back, if an error occurs.

The infinite log file: the log file is a circularly reused file. When anew record is added, it is appended to the end of the file. When the logfile reaches its capacity, the Log File Service waits for writes tooccur and frees space for new entries.

As may be seen from the above, the log file retains a description ofonly the latest transactions, which means that it can only be used as anauxiliary source of information, since it does not provide a guaranteeof a consistent backup. Following that logic, by using the bitmap, it ispossible to archive the marked blocks, in addition to a previouslycreated archive.

Due to the fact that the final description is also subject to archiving,the modification of the bitmap and the archiving can take placesimultaneously. For example, it is possible to archive MFT blockssimultaneously with verification of identity of the file structures ofthe archive blocks. Identical blocks of the original MFT and the currentMFT are not archived. At the same time, in some cases, the identity ofthe blocks frequently is due to the identity of the corresponding files,although it is not a guarantee of that.

For files with distributed blocks, for example, in logical structuresdescribed by FAT16 and FAT32, the proposed method of backup organizationalso permits to considerably shorten the time necessary for checking ofdata blocks of the files. This is due to the fact that some of the filesare excluded from this process, without any further need for subsequentchecking of data block identity. In some cases, when the data blockaddress is changed (for example, due to defragmentation process), it ispossible to also change the address of the original cluster, as well assubsequent clusters. If this is done, no subsequent checking of the datablocks needs to be performed, which reduces the volume of computationnecessary for the archiving, compared to a block by block comparison ofthe contents of the hard disk drive.

In some cases, it is possible to use a comparison of used blocks bitmapwith current and previously stored states of the hard disk drive. Inthis case, blocks that were previously free are excluded fromconsideration, and are archived without any further examination of thecontents of the data blocks.

In another case, the description of the logical structures can becompared not directly, but through a creation of additional datastructures, and subsequent comparison of such data structures. Forexample, when forming a snapshot of logical structure descriptions, itis possible to convert them by, for example, using various transformingfunctions, such as hash functions. Hash functions are one example ofalgorithms that transform a string of bytes into a usually shorter valueof a fixed length, that represents the original string. This is called ahash value. When hashing a data block, or a file, the contents isconverted into a short bit string—a hash value—and it impossible torecover the original message from the hash value. A hash value is uniquein the sense that two different files cannot result in the same bit.Therefore, only the values of the hash functions need to be preserved,and can be stored together with, or added to, the snapshot.

In order to determine the identity of the logical structures, the hashfunctions of the descriptors can be compared, as well as the hashfunctions of the descriptors of the current state of the hard diskdrive. Also, in one embodiment, bit-wise comparison of the hashfunctions can be performed.

Depending on the length of the key that is generated by the hashoperation, some other mechanisms may be added to verify blocks thatshould or should not be subject to archiving.

In fact, relatively short hash values may be generated and comparedfairly rapidly. If hash values being compared are different, it showsthat the hashed contents are different too. However, using a short hashkey results in a non-zero probability that different contents may havethe same hash function value. For example, if maximum hash functionvalue is less then number of different data blocks (here, groups ofphysical storage units), different data blocks can have the same hashfunction. Therefore, when a possibility of omitting data required forarchiving needs to be reduced to zero value, additional operation ofcomparing blocks with the same hash function values may be implementedto prove that the data blocks at issue really are the same.

If the hash key length is relatively long, this gives an acceptableguarantee that the data block with the same hash values are in fact thesame, e.g., the MD5 function gives about 10³⁷ different keys, and noadditional comparing of data blocks with the same hash values required.In this case, however, physical storage units from data blocks withdifferent hash values may be compared to exclude additional storageunits from archiving, e.g., for saving archiving storage space.

The advantage of using hash value comparison is in that, first, itspeeds up the comparison process, since the value of the hash functionis much less in size than the data itself, and, second it permitssimplification of comparison of fragmented data. In disk driveterminology, “structure(s)” may be used that emulates a tree structurewith a set of linked nodes. Each node has zero or more child nodes,which are below it in the tree. A node that has a child is called thechild's parent node. A child has at most one parent; a node without aparent is called the root node (or “root”). Usually a placeholder forstoring root information concerning the file is fixed in length. In suchcases, when the file descriptor has more bytes than the placeholder canhold, links or pointers to blocks that contain additional informationare used. Such structures (leaf nodes) may be physically stored awayfrom the root node, may be fragmented or may be changed withoutmodifying the contents of the file, e.g., while changing long file nameonly. For example, descriptors of files, e.g., inodes, which can havelinks to indirect blocks and remote inodes in this case, the inodes arehashed, together with the indirect blocks, which permits a rapidcomparison of the hash function values and also permits grouping offragmented data sets.

In one example, for structures described in FAT16 and FAT32 with apossibility of file fragmentation, a significant characteristic of theirlogical structure description is not only the file length and theaddress of the first data block, but also the location of all the blocksof the file. This information can be extracted sequentially for all theblocks of the file, and hashed together with the hashing of the FAT.This approach can also be used in NTFS, to verify B-trees.

To implement the method, it is possible to use various approaches thatsuspend disk operations during the time that the archive is beingformed. Single threaded run mode or single threaded disk access can beused. This can be accomplished by an operating system that maintains asingle-threaded environment or by one that provides file system locking,and hence allows exclusive access. For example, the MS-DOS operatingsystem provides exclusive file access because it is a single-threadedenvironment, at least from an application program's perspective. A Linux(or another UNIX-like) operating system can be used, utilizing systemlocks to provide exclusive access. While the Windows operating systemsare multi-threaded, they can defer to MS-DOS, Linux or anothersingle-threaded environment. An archiving program according to theinvention can begin execution in these multi-threaded environments, andthen can pass control to a code that runs in DOS or Linux mode and thusprovides exclusive disk access. Some operating systems also providelocks that ensure exclusive disk access.

Also, when practicing the method described above, the freezing, orsuspension, of disk access can be replaced with other mechanisms forpreserving the contents of the hard disk drive at the moment when thebackup process begins. For example, it is possible to create anadditional data structure that includes the contents of the data blocksas described in co-pending application Ser. No. 11/016,727, entitledSystem and Method for Incremental Backup of Local Drive Data, filed onDec. 21, 2004, which is incorporated herein by reference in itsentirety. Subsequently, this structure can be used as part of theincremental backup, or, alternatively, the contents of the data blockscan be moved into an incremental backup after checking it for necessityof archiving these blocks.

As yet another alternative, data that is subject to being written to thehard disk drive can be stored in some temporary data storage, withsubsequent copying to the hard disk drive, once the formation of theincremental snapshot is completed.

From the perspective of the method described above, it is not criticalexactly how files are organized into a logical structure, since theprimary concern is how the file is described, rather than its locationin the logical hierarchy. In other words, to establish identity ofdescriptions, it is possible to merely compare relevant file attributes.For instance, it is possible to compare the dates of changes to filecontents, and ignore the dates of renaming of files, if the operatingsystem permits this. Also, for files stored on a disk, it is possible toexamine hash value functions of the file contents (e.g., MD 5 and SHA-1,which are two commonly used hash functions) and in the future, thesevalues can be used for a preliminary analysis after identity isestablished based on file hashes and file descriptions. A more detailedcomparison can then be made.

Note that the method described above is particularly applicable to filesystems with contiguously arranged data blocks, for example, NTFS.

Since the file descriptions are used in formation of the backup, uponuser request, some of the files can be excluded from the archivingprocess. Examples of data that may not be subject to backup includevarious swap and paging structures, temporary files, and various otherfiles, as identified by the user. If identity is not determined it ispossible to perform an additional check as to the reasons for whyidentity is not established. For example, if the file containsadditional characteristics or metadata, which leads not to a change butto addition of other blocks to the file or, more commonly, to the filedescriptor, (for example, the appearance of new data streams), thebitmap needs only to reset the bits that correspond to newer blocks ofthe file.

As another example, additions can be performed, and if no identity ofthe contents exists, the corresponding blocks are always archived.

Additionally, to avoid the necessity of copying of identical data blocksinto the incremental backup, it is possible to have a second step in theverification of identity of the blocks. In this secondary verification,the contents of the blocks that were previously identified as notsubject to archiving is compared. At the same time, the contents of theblocks that were identified in a log file need not be checked forwhether they need to be archived.

In the case of the second step discussed above, blocks and/or clustersare grouped in some predetermined manner, and for these grouped blocks,hashes are generated, which are then compared. If the hashes areidentical, the corresponding blocks are marked as not subject toarchiving. If the hashes are not identical, additional verificationchecks of some of the blocks can be performed, for example, on a clusterby cluster basis.

The proposed method can also be used with generic file systems, such asReiserFS, ext3, XFS, JFS and XenFS.

When a file is being moved form one folder to another, which onlyaffects the entry in the MFT, the backup need not be made of the data,but only the MFT needs to be backed up, and the corresponding entriesand descriptors of the file.

Since the MFT is approximately 10% of the hard disk drive or apartition, the volume of the data that is being compared or restoredfrom a prior snapshot is significantly less compared to the entiredrive. Only those blocks whose data has not been changed are not backedup. Therefore, some of the blocks in the incremental backup may be“extra.”

FIG. 1 illustrates one exemplary method of the present invention. Asshown in FIG. 1, after starting the archiving process (step 102),storage writes are suspended (step 104). A bitmap of used storage units(i.e., blocks or clusters or sectors) is created (step 106). In step110, the bitmap is updated by unmarking some of the storage units thatare not subject of incremental backup. Such storage units are, forexample, physical blocks or clusters of storage device related tological storage units with coincident descriptors. Also, othermechanisms of identifying physical storage units that should not besubject of archiving may be implemented, as discussed below. In step112, units that are marked are archived as part of the incrementalbackup. This step may be executed simultaneously with step 110. In step114, storage writes are again permitted, and the process finishes instep 116.

FIG. 2 illustrates identification of physical storage units that shouldnot be subject of incremental backup being described in a particularimplementation of bitmap updating algorithm shown in FIG. 1 as step 110.In step 202, the bitmap updating process begins. It should be noted thatthe steps in FIG. 2 are described using records as examples. Suchrecords store information that characterizes logical storage units.Examples of records may be physical storage blocks, or parts of MFT filethat contains descriptors of files, or inodes, or other similar dataobjects. Commonly, descriptors of files are stored in the designateddisk area, and logical descriptors are stored in the same blocks, if thedescriptor is not changed. In this a case, the simplest way of comparingdescriptors is comparing records, represented by the physical storageblocks of the designated area. The task of counting records involves,for example, consecutively incrementing designated block addresses andcomparing contents of blocks with the same addresses that have been readfrom the storage device vs. those extracted from the previous backupstructure. A direct comparison of corresponding blocks' content may bereplaced with comparing hash function values, calculated for thoseblocks, or by any other appropriate method.

In step 210, the record pointer (e.g., address of an initial storageblock) is set, in other words, the records physical address isidentified. In step 220, the record to which the pointer points to isread from the disk. In step 225, the record to which the pointer pointsto is read from the snapshot. In step 230, comparing of descriptors oflogical storage units is provided. Note then descriptors may be comparedentirely or partially (for example, only file names, time stamps of filemodification and physical addresses of files' clusters may be compared).In another embodiment, a procedure for comparing descriptors or portionsof descriptors part may be implemented by calculating hash values fordescriptors or their parts and comparing calculated hash values. If theanswer is yes, i.e. descriptors are coincident, then in step 235physical storage units of the logical storage units are unmarked in thebitmap, and further do not considered as a subject of incrementalbackup. If the answer is no, i.e. descriptor of logical storage unit waschanged since previous backup, then corresponding physical storage unitsmay be subject of the incremental backup. Then the process goes to step235 to check if there are logical storage units being unexamined. Ifthere are unexamined logical storage units, the next record pointer isset in step 250, and the process then proceeds back to step 220. If allthe logical storage units from the selected area are examined, bit mapupdating is finished (step 240).

Some physical storage units outside the selected area may be archivedwithout additional checking. Such units may be blocks or clusters of theMFT, blocks with partition information, blocks of files indicated in thelog file described above, etc.

Additionally, it should be noted that after a defragmentation of thehard drive (or some other movement or relocation of the data blocks thatdoes not affect their contents), the descriptors are changed to ensurethat the new location of the data block is properly reflected in thecorresponding descriptors and/or the bitmap. Therefore, movement ofblocks may be properly analyzed during the update of the bitmap even ifcontent of the file itself does not change.

An example of the computer 102 is illustrated in FIG. 3. The computer102 includes one or more processors, such as processor 301. Theprocessor 301 is connected to a communication infrastructure 306, suchas a bus or network). Various software implementations are described interms of this exemplary computer system. After reading this description,it will become apparent to a person skilled in the relevant art how toimplement the invention using other computer systems and/or computerarchitectures.

Computer 102 also includes a main memory 308, preferably random accessmemory (RAM), and may also include a secondary memory 310. The secondarymemory 310 may include, for example, a hard disk drive 312 and/or aremovable storage drive 314, representing a magnetic tape drive, anoptical disk drive, etc. The removable storage drive 314 reads fromand/or writes to a removable storage unit 318 in a well known manner.Removable storage unit 318 represents a magnetic tape, optical disk, orother storage medium that is read by and written to by removable storagedrive 314. As will be appreciated, the removable storage unit 318 caninclude a computer usable storage medium having stored therein computersoftware and/or data.

In alternative implementations, secondary memory 310 may include othermeans for allowing computer programs or other instructions to be loadedinto computer 102. Such means may include, for example, a removablestorage unit 322 and an interface 320. An example of such means mayinclude a removable memory chip (such as an EPROM, or PROM) andassociated socket, or other removable storage units 322 and interfaces320 which allow software and data to be transferred from the removablestorage unit 322 to computer 102.

Computer 102 may also include one or more communications interfaces,such as communications interface 324. Communications interface 324allows software and data to be transferred between computer 102 andexternal devices. Examples of communications interface 324 may include amodem, a network interface (such as an Ethernet card), a communicationsport, a PCMCIA slot and card, etc. Software and data transferred viacommunications interface 324 are in the form of signals 328 which may beelectronic, electromagnetic, optical or other signals capable of beingreceived by communications interface 324. These signals 328 are providedto communications interface 324 via a communications path (i.e.,channel) 326. This channel 326 carries signals 328 and may beimplemented using wire or cable, fiber optics, an RF link and othercommunications channels. In an embodiment of the invention, signals 328comprise data packets sent to processor 301. Information representingprocessed packets can also be sent in the form of signals 328 fromprocessor 301 through communications path 326.

The terms “computer program medium” and “computer usable medium” areused to generally refer to media such as removable storage units 318 and322, a hard disk installed in hard disk drive 312, and signals 328,which provide software to the computer 102.

Computer programs are stored in main memory 308 and/or secondary memory310. Computer programs may also be received via communications interface324. Such computer programs, when executed, enable the computer 102 toimplement the present invention as discussed herein. In particular, thecomputer programs, when executed, enable the processor 301 to implementthe present invention. Where the invention is implemented usingsoftware, the software may be stored in a computer program product andloaded into computer 102 using removable storage drive 314, hard drive312 or communications interface 324.

FIG. 4 illustrates a system block diagram of one embodiment of theinvention. As shown in FIG. 4, a main storage 402 interfaces with an I/Oapplication 414 for the purpose of backing up file data. The I/Oapplication 404 maintains a bitmap 414, as discussed above, which keepstrack of selected area of the disk, e.g. used blocks (i.e., blocks thatcontain useful data), or blocks of logical units that area not reflectedin a log of changes. The latter may stay out of consideration, since itshould be backed up in any way. A backed up data storage area 406consists of at least a snapshot 412, a previous incremental backup 410,and the backup currently under consideration (408), based on thecontents of the marked blocks. At time t₁ the bitmap is maintained basedon the state of the main storage 402 then, at time t₂ the descriptorsare compared (416) and after updating bitmap, at time t₃ content ofmarked physical storage units is transferred to incremental backupstorage 408.

Having thus described a preferred embodiment, it should be apparent tothose skilled in the art that certain advantages of the described methodand apparatus have been achieved. It should also be appreciated thatvarious modifications, adaptations, and alternative embodiments thereofmay be made within the scope and spirit of the present invention. Theinvention is further defined by the following claims.

1. A method of incremental backup of a storage device, comprising: (a)selecting an area of the storage device for backup; (b) readingdescriptors of logical storage units of the selected area; (c) comparingthe descriptors of the logical storage units of the selected area withdescriptors of already archived logical storage units; (d) for physicalstorage units related to logical storage units of the selected areawhose descriptors are not identical to the descriptors of the archivedlogical storage units, checking if these physical storage units need tobe backed up; and (e) backing up contents of physical storage unitsidentified in step (d).
 2. The method of claim 1, further comprisingbacking up contents of physical storage units of the storage deviceoutside the selected area.
 3. The method of claim 1, wherein step (c)further comprises comparing values of hash function calculated for thedescriptors of the logical storage units.
 4. The method of claim 1,wherein the logical storage units are files.
 5. The method of claim 1,wherein the physical storage units are blocks or clusters.
 6. The methodof claim 1, wherein the descriptors are MFT entries.
 7. The method ofclaim 1, wherein, step (d), further comprising generating hash functionvalues for physical storage units and comparing the hash function valuesof the physical storage units for physical storage units of the storagedevice and already archived physical storage units, having the sameaddresses.
 8. The method of claim 7, wherein the hash function value isgenerated for group of physical storage units.
 9. The method of claim 7,wherein hash function generates relatively short hash function value,further comprising comparing blocks having identical hash functionvalues.
 10. The method of claim 7, wherein a control sum is used as ahash function value.
 11. The method of claim 7, wherein hash functiongenerates a long hash function value, further comprising step ofcomparing blocks from group with different hash function values.
 12. Themethod of claim 1, wherein the descriptors include time stamps.
 13. Themethod of claim 1, wherein the descriptors include checksums.
 14. Themethod of claim 1, wherein the descriptors include file metadata. 15.The method of claim 1, wherein descriptors being content of somephysical storage units, further comprising comparing the descriptors ona physical storage unit basis.
 16. The method of claim 1, furthercomprising: generating a bitmap of the selected physical storage unitsof the storage device, with all selected physical storage units marked;in step (d) unmarking, in the bitmap, those physical storage units thatcorrespond to the archived logical storage units with coincidentdescriptors; and in step (e) backing up content of the physical storageunits marked in the bitmap.
 17. The method of claim 1, furthercomprising backing up content of at least some used physical storageunits of the storage device lying outside the selected area.
 18. Themethod of claim 17, wherein used physical storage units relate to thelogical storage units of the storage device having the same name ascorresponding archived logical storage units, but different time stamps.19. The method of claim 1, wherein used physical storage units relate tofurther comprising archiving physical storage units of the logicalstorage units of the storage device having names that are not presentthe storage device wherein the archived physical storage units are notincluded to the selected area.
 20. The method of claim 1, wherein step(d) comprises bit-wise comparison of the content physical storage units.21. A system for incremental backup of a storage device, comprising: (a)means for selecting an area of the storage device for backup; (b) meansfor reading descriptors of logical storage units of the selected area;(c) means for comparing the descriptors of the logical storage units ofthe selected area with descriptors of already archived logical storageunits; (d) for physical storage units related to logical storage unitsof the selected area whose descriptors are not identical to thedescriptors of the archived logical storage units, means for checking ifthese physical storage units need to be backed up; and means for backingup contents of physical storage units identified in (d).
 22. A systemfor incremental backup, comprising: a main storage that includesphysical storage units and logical storage units; an archive of aprevious state of the main storage; and a plurality of descriptorscorresponding to the logical storage units, wherein, for those logicalstorage units whose descriptors are not the same as descriptors ofarchived logical storage units, an incremental backup is performed ofcorresponding physical storage units.